I realise that the process calling this function must have TCB privileges
which I do not have so I am writing this into an ActiveX exe that I can
install on a server with the required privilege and call using DCOM.  That
way any clients do not need to have the TCB privileges.

As there is no development server available yet, I decided to test it on my
NT4 workstation for the time being, just to check for bugs.  The logonuser
call fails every time (as expected) but I expected to get an access denied
error whereas GetLastError always returns zero.  Obviously I'll test it on a
development server evntually but I want to know if I can expect it to work...
as it stands I have my concerns!

Any ideas anyone please?

Ian